Problem/Motivation
Moderated content page could be empty even if the current user has access to "in-moderation" content. Based on my quick analysis, this happens because content_moderation only implements hook_entity_access() and not hook_node_access_records() and hook_node_grants(). Therefore if a user should have access to a moderated content but you have a module X enabled that implements node access hooks then the moderated content won't appear on the Moderated content page. This does not happen because module X works incorrectly. It happens because content_moderation should grant access to a moderated node when Views collects available moderated nodes for a user in query time, but it only does it in "runtime", in other words, when Views have already collected and loaded entities from the database.
Steps to reproduce
* Enable a module that implements hook_node_access_records()/hook_node_grants() for the "view" operation. (Like the node_test module.)
* Enable Content moderation and configure it for an access controlled node type.
* Create limited content creator/moderator roles/users.
* Create content with content creator (or admin) and save it in draft moderation state.
* Login with content moderator and check the "Moderated content" page. Expected result: the created node is visible. Actual behavior: The node is not visible, but by opening the node's path directly, the moderator has access.
Minimum role setup for Content Moderator (for the "Editorial" workflow shipped by the Standard profile):
langcode: en
status: true
dependencies: { }
id: content_moderator
label: 'Content moderator'
weight: 3
is_admin: null
permissions:
- 'access content overview'
- 'access toolbar'
- 'use editorial transition publish'
- 'view any unpublished content'
- 'view latest version'
- 'view the administration theme'
Proposed resolution
Remaining tasks
User interface changes
API changes
Data model changes
Release notes snippet
| Comment | File | Size | Author |
|---|---|---|---|
| #17 | Screenshot from 2024-11-05 11-27-10.png | 154.24 KB | morvaim |
| #17 | Screenshot from 2024-11-05 11-28-00.png | 96.27 KB | morvaim |
Comments
Comment #2
mxr576I have just realised that this could be easily tested with the Standard install profile and the
node_testtest module.Comment #3
sam152 commentedUsing the grants system has all sorts of weird semantics, as has been highlighted by a lot of the recent group security releases. Personally I would rather users who need grants to evaluate implementing them for content_moderation as a seperate non-core module.
Inflicting grants on all the users who currently have content moderation installed seems like a really bad idea to me personally.
Adding a related issue, because personally I would love to see node grants be removed from core.
Comment #4
sam152 commentedComment #5
pameeela commentedComment #6
mxr576+1, totally agree with that.
But that is a long shot solution, like something lands in Drupal 10 or 15... and until that it lands in core we still need some kind of core/contrib solution that could be used on those sites that are using node grant. New and even veteran Drupal developers are both using node grants bacause this is the "documented solution".
Also I am not following how Search API works nowadays, but as far as I remember, it only supported node grants-based access checking back in the good old days. Would/does it work with entity query alters?
Comment #10
codebymikey commentedA contrib module attempting to address this issue has now been published.
https://www.drupal.org/project/content_moderation_node_grants
Ideally this module should be within core to maintain parity.
Comment #14
mxr576Comment #15
morvaim commentedI couldn't replicate this problem. If the user has the View any unpublished content then all moderated content is listed regardless of `hook_node_access_records()` and `hook_node_grants()` implementations. Couldn't be that the problem here is that there is a "hidden" step during configuring Content moderation and the Content moderation view needs to be updated, because the Content revision: Moderation state filter needs to be configured and until that no content appears on the moderated content listing page?
Comment #16
morvaim commentedContent revision: Moderation state needs to be set, after setting up a Workflow, see attached images.
Comment #17
morvaim commentedComment #18
acbramley commentedI tend to agree with #3 here, given there's a contrib module for this is this something we need to consider for core? I don't think this is a major bug either